Analysis
-
max time kernel
300s -
max time network
303s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 04:48
Static task
static1
Behavioral task
behavioral1
Sample
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe
Resource
win10-20231215-en
General
-
Target
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe
-
Size
170KB
-
MD5
902c4b980384894283b534c3d8972a5f
-
SHA1
8c05e7d329f359b7fbe4648dfe59872f530cd12e
-
SHA256
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05
-
SHA512
fc446e5d24f11c7d4fc64eb018d3c2e8e728bc2e1372fd5cf76caf6ba09d5666a5291684ce120f3c4c40191584fa9785f916b1b62f91cbe40a6d1eb129133431
-
SSDEEP
3072:fpMb0SXiEmLCpYbz8/UVS7OiJIvVO77NSYZA7kO0IDm:fp0VXTECObAUO7DUD
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Extracted
redline
Exodus
93.123.39.68:1334
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Default
93.123.39.68:4449
kszghixltbdczq
-
delay
1
-
install
true
-
install_file
chromeupdate.exe
-
install_folder
%AppData%
Signatures
-
DcRat 2 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe 632 schtasks.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3D71.exe family_redline behavioral1/memory/560-91-0x00000000012C0000-0x00000000012DE000-memory.dmp family_redline behavioral1/memory/560-93-0x0000000004A30000-0x0000000004A70000-memory.dmp family_redline behavioral1/memory/2800-239-0x0000000000AD0000-0x0000000000AEE000-memory.dmp family_redline -
SectopRAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3D71.exe family_sectoprat behavioral1/memory/560-91-0x00000000012C0000-0x00000000012DE000-memory.dmp family_sectoprat behavioral1/memory/560-93-0x0000000004A30000-0x0000000004A70000-memory.dmp family_sectoprat behavioral1/memory/2800-239-0x0000000000AD0000-0x0000000000AEE000-memory.dmp family_sectoprat behavioral1/memory/560-244-0x0000000004A30000-0x0000000004A70000-memory.dmp family_sectoprat behavioral1/memory/864-246-0x000000001B050000-0x000000001B0D0000-memory.dmp family_sectoprat behavioral1/memory/2800-356-0x0000000004890000-0x00000000048D0000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\adasda.exe family_asyncrat -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
pid process 1284 -
Executes dropped EXE 7 IoCs
Processes:
90CB.exe2B07.exe3D71.exehtdctatadasda.exeasdjijjjjj.exechromeupdate.exepid process 2820 90CB.exe 3008 2B07.exe 560 3D71.exe 2260 htdctat 864 adasda.exe 2800 asdjijjjjj.exe 1112 chromeupdate.exe -
Loads dropped DLL 7 IoCs
Processes:
WerFault.exe3D71.exepid process 1936 WerFault.exe 1936 WerFault.exe 1936 WerFault.exe 1936 WerFault.exe 1936 WerFault.exe 560 3D71.exe 560 3D71.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1936 3008 WerFault.exe 2B07.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
htdctat1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe90CB.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htdctat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90CB.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90CB.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90CB.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htdctat Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htdctat -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1880 timeout.exe -
Processes:
asdjijjjjj.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 asdjijjjjj.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 asdjijjjjj.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 asdjijjjjj.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 asdjijjjjj.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exepid process 2312 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe 2312 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe90CB.exehtdctatpid process 2312 1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe 2820 90CB.exe 2260 htdctat -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
3D71.exeasdjijjjjj.exeadasda.exechromeupdate.exedescription pid process Token: SeShutdownPrivilege 1284 Token: SeShutdownPrivilege 1284 Token: SeShutdownPrivilege 1284 Token: SeDebugPrivilege 560 3D71.exe Token: SeShutdownPrivilege 1284 Token: SeShutdownPrivilege 1284 Token: SeDebugPrivilege 2800 asdjijjjjj.exe Token: SeDebugPrivilege 864 adasda.exe Token: SeDebugPrivilege 1112 chromeupdate.exe Token: SeShutdownPrivilege 1284 Token: SeShutdownPrivilege 1284 Token: SeShutdownPrivilege 1284 Token: SeShutdownPrivilege 1284 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chromeupdate.exepid process 1112 chromeupdate.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
2B07.execmd.exetaskeng.exe3D71.exeadasda.execmd.execmd.exedescription pid process target process PID 1284 wrote to memory of 2820 1284 90CB.exe PID 1284 wrote to memory of 2820 1284 90CB.exe PID 1284 wrote to memory of 2820 1284 90CB.exe PID 1284 wrote to memory of 2820 1284 90CB.exe PID 1284 wrote to memory of 3008 1284 2B07.exe PID 1284 wrote to memory of 3008 1284 2B07.exe PID 1284 wrote to memory of 3008 1284 2B07.exe PID 1284 wrote to memory of 3008 1284 2B07.exe PID 3008 wrote to memory of 1936 3008 2B07.exe WerFault.exe PID 3008 wrote to memory of 1936 3008 2B07.exe WerFault.exe PID 3008 wrote to memory of 1936 3008 2B07.exe WerFault.exe PID 3008 wrote to memory of 1936 3008 2B07.exe WerFault.exe PID 1284 wrote to memory of 2996 1284 cmd.exe PID 1284 wrote to memory of 2996 1284 cmd.exe PID 1284 wrote to memory of 2996 1284 cmd.exe PID 2996 wrote to memory of 580 2996 cmd.exe reg.exe PID 2996 wrote to memory of 580 2996 cmd.exe reg.exe PID 2996 wrote to memory of 580 2996 cmd.exe reg.exe PID 1284 wrote to memory of 560 1284 3D71.exe PID 1284 wrote to memory of 560 1284 3D71.exe PID 1284 wrote to memory of 560 1284 3D71.exe PID 1284 wrote to memory of 560 1284 3D71.exe PID 1688 wrote to memory of 2260 1688 taskeng.exe htdctat PID 1688 wrote to memory of 2260 1688 taskeng.exe htdctat PID 1688 wrote to memory of 2260 1688 taskeng.exe htdctat PID 1688 wrote to memory of 2260 1688 taskeng.exe htdctat PID 560 wrote to memory of 864 560 3D71.exe adasda.exe PID 560 wrote to memory of 864 560 3D71.exe adasda.exe PID 560 wrote to memory of 864 560 3D71.exe adasda.exe PID 560 wrote to memory of 864 560 3D71.exe adasda.exe PID 560 wrote to memory of 2800 560 3D71.exe asdjijjjjj.exe PID 560 wrote to memory of 2800 560 3D71.exe asdjijjjjj.exe PID 560 wrote to memory of 2800 560 3D71.exe asdjijjjjj.exe PID 560 wrote to memory of 2800 560 3D71.exe asdjijjjjj.exe PID 864 wrote to memory of 2552 864 adasda.exe cmd.exe PID 864 wrote to memory of 2552 864 adasda.exe cmd.exe PID 864 wrote to memory of 2552 864 adasda.exe cmd.exe PID 2552 wrote to memory of 632 2552 cmd.exe schtasks.exe PID 2552 wrote to memory of 632 2552 cmd.exe schtasks.exe PID 2552 wrote to memory of 632 2552 cmd.exe schtasks.exe PID 864 wrote to memory of 2968 864 adasda.exe cmd.exe PID 864 wrote to memory of 2968 864 adasda.exe cmd.exe PID 864 wrote to memory of 2968 864 adasda.exe cmd.exe PID 2968 wrote to memory of 1880 2968 cmd.exe timeout.exe PID 2968 wrote to memory of 1880 2968 cmd.exe timeout.exe PID 2968 wrote to memory of 1880 2968 cmd.exe timeout.exe PID 2968 wrote to memory of 1112 2968 cmd.exe chromeupdate.exe PID 2968 wrote to memory of 1112 2968 cmd.exe chromeupdate.exe PID 2968 wrote to memory of 1112 2968 cmd.exe chromeupdate.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe"C:\Users\Admin\AppData\Local\Temp\1216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05.exe"1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\90CB.exeC:\Users\Admin\AppData\Local\Temp\90CB.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2B07.exeC:\Users\Admin\AppData\Local\Temp\2B07.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 962⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3584.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Users\Admin\AppData\Local\Temp\3D71.exeC:\Users\Admin\AppData\Local\Temp\3D71.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adasda.exe"C:\Users\Admin\AppData\Local\Temp\adasda.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'4⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB220.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\chromeupdate.exe"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe"C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {C688A2A7-8E8B-4DEC-8BCD-FC6C68F7A738} S-1-5-21-928733405-3780110381-2966456290-1000:VTILVGXH\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\htdctatC:\Users\Admin\AppData\Roaming\htdctat2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2B07.exeFilesize
6.3MB
MD5b1e8d4d7dd26612c17eccbf66b280e7c
SHA197dd5e81a4014fb54ef5ac3f1db88519843c85c2
SHA256e3940372b04a4cb2177ae409c195debccfe004600d73a39d429a577d248d4cb2
SHA512ff70dd3103128cd36bd1da3a734e635ec76d53a5629fc1f05941d6cadb9e82310da0ea298dcf449ef17c42a70ea7d787a75585ffa37a74f9007ca91a4481ecc8
-
C:\Users\Admin\AppData\Local\Temp\3584.batFilesize
77B
MD555cc761bf3429324e5a0095cab002113
SHA12cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA51233f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
-
C:\Users\Admin\AppData\Local\Temp\3D71.exeFilesize
95KB
MD557935225dcb95b6ed9894d5d5e8b46a8
SHA11daf36a8db0b79be94a41d27183e4904a1340990
SHA25679d7b0f170471f44ed6c07ddb4c4c9bb20c97235aef23ac052e692cb558a156d
SHA5121b6362bdb7f6b177773357f5fe8e7d7ee44716fd8e63e663e446f4e204af581491d05345c12cd9cca91fd249383817da21ef2241011cdc251b7e299560ea48c0
-
C:\Users\Admin\AppData\Local\Temp\90CB.exeFilesize
229KB
MD5d10ceb31dff3ca0c51709fa32cfa078e
SHA16c07a177d886c49d96aa47ae19a6672120592c8c
SHA256f6ccdda55b0298c9cd9c5dedd9a929bd370e6855edbf6cb0e66b4d9af610d139
SHA51282118dbb5fdfb5e19e2db72774d5a6e86d5a1a238eac93072ccc9ecdaa6755e6ae51082ffaa9e49aed882f95719bb41c5472149d2beff0cb43902e52c5415f43
-
C:\Users\Admin\AppData\Local\Temp\Cab6B24.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar6B84.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\tmp71A1.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp71C7.tmpFilesize
92KB
MD527c629ed950ac6d3af5837e9ca3c422b
SHA1e1ebe8b21aa6b38c32d3ef3a5fbfe8e75e238e58
SHA2567cf63b64af2ccf5067e25b539bf7a867441623f0ec7c39f5271c6a3983e088e6
SHA512c8a586719523f3a3b55fc6ad04c8b509fe00c21a7802ae590368edca4c19d7dc326e6cfc75221550d3e86c634611e8103fa8e3c6694222d49184ca56a2bc9ca4
-
C:\Users\Admin\AppData\Local\Temp\tmpB220.tmp.batFilesize
156B
MD50b354148053b8cdc2173adfdb1d3605e
SHA15ffd17985026cdef8e0bba1be425eb170040d2ef
SHA2565d0938ab26fe413157acef43e71889ceb3ac879bb32e786c418798c30a5aabba
SHA512e6f3f127487bd9a414f9ae56cc3d9455c66ac789e34faab263364ebdfd78ca8d136a6c0e1c306a06c461105dc23c5d86a5b96bb5ae97e0a1418f615ac7a88b66
-
C:\Users\Admin\AppData\Local\Temp\tmpBAAA.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\htdctatFilesize
170KB
MD5902c4b980384894283b534c3d8972a5f
SHA18c05e7d329f359b7fbe4648dfe59872f530cd12e
SHA2561216f48b727c93df1945ecca6261c637f7860520b213e7f9582e33b1c969fe05
SHA512fc446e5d24f11c7d4fc64eb018d3c2e8e728bc2e1372fd5cf76caf6ba09d5666a5291684ce120f3c4c40191584fa9785f916b1b62f91cbe40a6d1eb129133431
-
\Users\Admin\AppData\Local\Temp\2B07.exeFilesize
1.5MB
MD588f4b0324f239ac9cbdfe7b46159ee84
SHA113083fbedfca0d9fbec91961ccf918b2c0ae0144
SHA2567fa93147525a76daa75099a2e1a8c9a96fc10d23c8a6cbfdfe2e8a65f4209774
SHA51216c32960f67f0b4e675c9fcf75d6a446b9be2634124e08a05e6039d95e426e86daf817057f58bbac715205e45797dcdee55555d3970bd4aca03c6e610e9d2741
-
\Users\Admin\AppData\Local\Temp\2B07.exeFilesize
1.3MB
MD5f18558158c88449acdfd11da800a2890
SHA1138b05edae65995885b01bb52a05e23a6595e388
SHA25602751935d51ba60465d00c82af67ca9bb93d98d8f2812b2e6803df2973fd214d
SHA512ebddf98941b03b98f8b915b468ebce56a9dc164031307fce8ed2aea2184a749f1317f179c824f6184d46aede9a4dd6b1087e6e32c630e411478f761e8b22989c
-
\Users\Admin\AppData\Local\Temp\2B07.exeFilesize
3.9MB
MD5b70e4ca63a2488ba2635ba19bff5347f
SHA120be28390653f641cb1f57252a5df6d59c3fa27e
SHA256b6146dd0f59f8f1f19af1d56e0ec9e3543eee7b4275331c91fe5ae121ecb9253
SHA5122c136575d5ab1088d97a1aa93acecd8977725da5da9b32f2b32f8398fe6ae4df9ab588e18f87a6b46e3232ff3b04c09e36968a91b92d2f91b48f745061742edc
-
\Users\Admin\AppData\Local\Temp\2B07.exeFilesize
3.6MB
MD5534ea27d26a51a2578cd638be7550529
SHA103b46feb6780d4ae53de044299df1d1ae682de85
SHA256654c50319332de4d707f1c3e38f2f8fc5bfea19753af81bbc608e18e162dfd9d
SHA512f90ea62e9f624320e8d4461432c46600bc1165445c7d81568b69559d4b373e3779cf22334ef7c325bcaaffe8de10c0f23bf09b0095d060f9b45baf544b18330a
-
\Users\Admin\AppData\Local\Temp\2B07.exeFilesize
2.5MB
MD5e21e52f3597db5fb6b0ce7bc1cae1b99
SHA1ffa12d6826c10915752f9c0b0cdeef50b60b0abc
SHA2563f1e5359a4c148f9d37fb895b0a7fd8de82dcb0cb1f0abbef2e2f8891264bd2e
SHA512b9c4009019d9524f3b8aa6233ce5dfc82b97d21457b140e5e80d55255b5ac97548f6ce5c5e48905d82ce7de89c222e95d1b11acd6a5ef014508b06cd2aabdce3
-
\Users\Admin\AppData\Local\Temp\adasda.exeFilesize
73KB
MD525b6389bbaa746df85d53714d4a6d477
SHA186e6443e902f180f32fb434e06ecf45d484582e3
SHA2564b02692bf468a164e333bbfc961c5974d0a95009a72ea8bff2e9cb677eae4f56
SHA5126ad22c119b548f0e8ed5adb6c9f48c33b356340a7309c8185bec817f2562ae99760ff79e131c89bce2be122b6385bee610704f37edb7f1656a1b9d4782a1fcf4
-
memory/560-248-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/560-244-0x0000000004A30000-0x0000000004A70000-memory.dmpFilesize
256KB
-
memory/560-93-0x0000000004A30000-0x0000000004A70000-memory.dmpFilesize
256KB
-
memory/560-92-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/560-91-0x00000000012C0000-0x00000000012DE000-memory.dmpFilesize
120KB
-
memory/560-236-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/864-241-0x000007FEF5850000-0x000007FEF623C000-memory.dmpFilesize
9.9MB
-
memory/864-260-0x000007FEF5850000-0x000007FEF623C000-memory.dmpFilesize
9.9MB
-
memory/864-240-0x0000000000DE0000-0x0000000000DF8000-memory.dmpFilesize
96KB
-
memory/864-246-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/864-249-0x0000000077A50000-0x0000000077BF9000-memory.dmpFilesize
1.7MB
-
memory/864-259-0x0000000077A50000-0x0000000077BF9000-memory.dmpFilesize
1.7MB
-
memory/1112-353-0x000007FEF4E60000-0x000007FEF584C000-memory.dmpFilesize
9.9MB
-
memory/1112-358-0x000007FEF4E60000-0x000007FEF584C000-memory.dmpFilesize
9.9MB
-
memory/1112-359-0x0000000077A50000-0x0000000077BF9000-memory.dmpFilesize
1.7MB
-
memory/1112-354-0x000000001B020000-0x000000001B0A0000-memory.dmpFilesize
512KB
-
memory/1112-351-0x00000000001F0000-0x0000000000208000-memory.dmpFilesize
96KB
-
memory/1112-355-0x0000000077A50000-0x0000000077BF9000-memory.dmpFilesize
1.7MB
-
memory/1284-20-0x0000000003860000-0x0000000003876000-memory.dmpFilesize
88KB
-
memory/1284-4-0x0000000002A10000-0x0000000002A26000-memory.dmpFilesize
88KB
-
memory/1284-106-0x0000000003B10000-0x0000000003B26000-memory.dmpFilesize
88KB
-
memory/2260-97-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/2260-108-0x0000000000400000-0x0000000002BD7000-memory.dmpFilesize
39.8MB
-
memory/2260-98-0x0000000000400000-0x0000000002BD7000-memory.dmpFilesize
39.8MB
-
memory/2312-5-0x0000000000400000-0x0000000002BD7000-memory.dmpFilesize
39.8MB
-
memory/2312-2-0x00000000001B0000-0x00000000001BB000-memory.dmpFilesize
44KB
-
memory/2312-3-0x0000000000400000-0x0000000002BD7000-memory.dmpFilesize
39.8MB
-
memory/2312-1-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/2800-245-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/2800-357-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/2800-242-0x0000000004890000-0x00000000048D0000-memory.dmpFilesize
256KB
-
memory/2800-239-0x0000000000AD0000-0x0000000000AEE000-memory.dmpFilesize
120KB
-
memory/2800-356-0x0000000004890000-0x00000000048D0000-memory.dmpFilesize
256KB
-
memory/2820-18-0x0000000000890000-0x0000000000990000-memory.dmpFilesize
1024KB
-
memory/2820-21-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/2820-19-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/3008-43-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/3008-30-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/3008-32-0x00000000001D0000-0x0000000000FFB000-memory.dmpFilesize
14.2MB
-
memory/3008-33-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/3008-110-0x00000000001D0000-0x0000000000FFB000-memory.dmpFilesize
14.2MB
-
memory/3008-35-0x00000000001D0000-0x0000000000FFB000-memory.dmpFilesize
14.2MB
-
memory/3008-37-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/3008-39-0x0000000077C50000-0x0000000077C51000-memory.dmpFilesize
4KB
-
memory/3008-38-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/3008-41-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/3008-58-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/3008-44-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/3008-68-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/3008-66-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/3008-63-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/3008-61-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/3008-46-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/3008-48-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/3008-71-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/3008-51-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/3008-53-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/3008-56-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB